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(54) Cellular mobile radio netwoilc discovery method and apparatus therefbr 



(57) A method and apparatus are provided for mon- 
itoring a cellular mobile radio system and tor indentify- 
ing monitored radio elements within the networic with 
respect to other networic entities. The logical and physi- 
cal topology of a cellular mobile racOo system is deter- 
mined by monitoring messages passed across a 
communicatkHis Interfece in the system. Embodiments 
of the invention associate common informatxm occur- 
ring In different messages, and over time, establish the 



topology of a networt^ even though messages passed 
aaoss the monitored interfsu^e do not conrprise unique 
system-wide addressing information. 

In particular, the present method provUes a map- 
ping between radio elements (TRX) and other networic 
entities (TEI. CI. and LAI) in a GSM type ceOular system 
by monitoring messages across the Abis and A inter- 
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Description tor example by temporarily or permanently Installing 

monitor probes on one or more links to monitor mes- 

The present invention relates to a network disocv- sages f towing on the link or links. A number of tech- 

ery method and apparatus for a cellular mobile racfio nlques are known for monitoring signalling messages in 

network, and in particular to a network discovery s order to detenmine various parameters off a cellular 

method and apparatus for identiffying radio elements mobile radio system. For example, European applica- 

within such a network. tion 94307978.0 discloses a technique for determining 

The present invention has partteular application to tocatton area intomiation for cells within a QSM-type 

cellular mobile radio systems operating according to the n^work. and European appTication 93309780.0 dis- 

QSM. DCS1 800. or the PCS1 900 standards. Systems io closes a technique for identifying the A interfoce iinl( on 

operating according to these standards, including deriv- which a monitor prot>e is installed. A technique for 

atives thereof, will hereinafter be referred to as "GSM- determining ttie functionality of nodes of a network is 

type' systems. It should, howaw, be noted ttiat the disclosed in European application 9S302382.7. This 

present invention is not restricted to a GSM-type sys- technique relies on the monitoring of signalling mes- 

tem. IS sages which include addressing information associating 

Cellular mobile radb systems, such as GSM-type tiie messages with specific nodes, as is for example the 
systems, compr^ a fixed part having switching ele- case for SS7 (Signalling System Na 7) links, 
ments and radio elements provkling radm coverage in a Acconfing to ttie present invention, there is pro- 
plurality off cells, and mobile stations for communicating vkled a networt^ discovery method for deternfttning infor- 
with the fixed part of the system. CeOs are offten logically 20 mation about a cellular mobile radio network comprfeing 
grouped into tocation areas. Within each cell, radio cov- a faed part having switching elements and radio ele- 
erage is provided by one or more radfo elements, which. ments providing radio coverage in a plurality off ceOs. 
in the case of GSM-type systems, comprise elementary each cen having at least one said teatSo element, and 
transceivers termed TRXs (Transmitter Receiver). mobile stations fbr communicating witii said fixed part 
Radio elements are grouped wittiin Base Transceiver ^ via ttie radio elements, the method comprising :-morntor* 
Stations (BTS) which communicate with Base Station ing signalling messages passed between the radio ele- 
Controllers (BSC). The interface between a BTS and ments and ttie switching elements, selecting at least 
BSC. within a GSM-type system, is referred to as the one signalling message in accordance to predeter- 
Abts interface, and individual links (generally oompris- mined selection criteria, extracting data from said at 
ing two physical channels) on ttiis interiSace are termed 30 least one message, correlating said eximcted data wHh 
Abis links. BSCs communicate with mobile switching previously extracted data and, repeating said selecting, 
centres (MSC) via what is termed ttie A interface. extracting and correlating steps until each monitored 

In order to monitor, and optimise, ttie periomiance radio element is identified witti respect to ottier networic 

of a cellular mobile radio system it is often necessary to entities. 

detemitne ttie topology of ttie networic Atthough ttiis ss The present applicant has appreciated ttiat in order 
infbrmation may be derived from switching elements. to identiify radio elements, tiie correlation off data 
such as BSCs and tha'r related databases, wittiin ttie extracted from a plurality off signalling messages passed 
fixed part of ttie networtt. ttiere are problems in doing between radio elements and switching elements is 
sa Rrstiy, alttiough many aspects off GSM-type net- required. Fbr GSM-type networks, ttiis requirement 
worics have been standardized, ttiere are some areas in 40 stems from ttie absence of unique network wide 
which equipment manufacturers have a number of tech- addressing information on ttie Abis interface between 
nologk^al choices whfoh will meet ttie relevant stand- radio elements or TRXs, and ttie BSC. Whereas ttie 
ards. and ottier areas in which standardization has not SS7 protocols utilised on ttie A Interface provide for ttie 
been enforced. An area which is not highly standardized urvque identification of A interface links, no such provi- 
is ttiat of Operation and Maintenance (O & M) mes- 45 sfon is made for Abis links. On ttie A Interfece, links 
sages. Thus in order to access 0 & M messages a spe- have an identifffoation which is given by ttie Origkiating 
cifffo. proprietary format whfoh is unk^ue to an equipment Point Code, ttie Destination Point Code and ttie Signal- 
manufacturer may be required. Secondly, due to ttie ling Link Code. Abis interface links have no such identi- 
highly sensitive nature of some infbrmation stored fication provided by protocol. Abis interfece links are 
within the fixed part off a networic a networic operator so identiffied Implicitiy by configuration information stored 
severely restricts access to databases associated witti wittiin ttie BSC, and TRXs are addressed by using an 
networic witching elements such as BSCs and MSCs. Mentiffier (a TEI - Tennlnal Endpoint Mentifier) whtoh is 
finally, ttiere is no guarantee ttiat ttie information stored allocated by ttie BSC. Embodiments off tiie present 
wittiin datat>ases associated witti switching elements is invention provide a technique tor building up Information 
up to date, since changes made to ttie system may not 55 on radio elements until their topofogical relationship to 
have been incorporated into ttiese databases. ottier networic entities can be identified. Such intonna- 
it is known to carry out independent monitoring of tion once determined can be used for mariy purposes, 
ttie signalling networic off a cellular mobOe radio networic For example it can be used to oonpare ttie level off net- 
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work resources available to the current level of usage of 
these resources. 

Although data may be extracted from a single mes- 
sage may usefully be used In the present network dis- 
covery technique, preferably a pair of signalling s 
messages are selected in accordance with predeter- 
mined selection aiteria. 

Often* cells within a mobile radio network are k)gl- 
cally grouped into location areas, and In this case a 
radio element is preferably identified by the cell within 10 
which it resides, and the location area within which the 
cell reskies. In embodiments of the present inventk)n. 
this hierarchical klentricatk)n by network entity provkles 
a iogmal klentifler for each radio element A physical 
kfentlfter. provkled by the nKMiHoring system may be is 
correlated with this logical identifier. 

Preferably the pre<letermined selectk)n criteria for 
selecting a pair of messages are. f ofsHy that each mes- 
sage is of a different message type, and secondly that 
the messages contain at least one fanfomiatton element 20 
in common. Advantageously, there is provided a further 
matching step in which the common inkxmation ele- 
ment In each of the messages is compared and data 
from the pair of messages is only utilised In sakJ corre- 
lating step if the common information element In each 2s 
message Is kJenttcal. 

Preferably data from a pair of messages is only uti- 
lised in identifying radb elements if the messages are 
monitored within a pre-determined time period of each 
other. It Is drffteutt to Mentify messages on the Abis inter- so 
Hice which relate to the same transactk>n, t>ecai»e sig- 
nalling messages on the Abis interface do not carry 
uruque kfentifk^tion informatioa By utilising only mes- 
sages which are monitored within a pre-determined 
period of each other, the iOcelihood that these messages 3S 
belong to the same transaction Is increased. Preferably 
the time period is one which Is typical for the time inter- 
val l>6tween the messages being monitored. 

Preferably, in addition to monitoring signalling mes- 
sages between racfio elements and switching elements, 40 
messages passed between two switching elements are 
also monitored. Thus, in QSM-type networks signalling 
messages on the A interf^oe. in addition to the Abis 
interface, are monitored. 

According to a second aspect of the present tnven- 4S 
tk>n, there is pravkied apparatus for klentifying the rela- 
tkmship between radk> elements and other networic 
entities within a cellular mobile radk> networi^, the net- 
work comprising a fixed part having switching elements 
and radio elements provkiing radio coverage in a plural- so 
Hy of cells, each cell having at least one sakJ radio ele- 
ment and mobDe stattons for oonununlcating with sakJ 
fixed part via the radio elements* the apparatus com- 
prising:- 

55 

probe means for monitoring signalling messages 
passed between an klentif led one of the radio ele- 
ments and the switching elements, extracting 
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means for extracting data from predetermined sig- 
nalling messages, analysis means for determining 
from extracted data a relationship between the 
monitored radk> element and other network entities. 

Embodiments of the present invention will now be 
descn'bed, by w£^ of example only, and with reference 
to the fbllowing drawings in which: 

Rgure 1 is a schematic diagram of a QSM-type 
mobile communications networic, 
Rgure 2 is a schematk; diagram of a three sector 
BTS showing the TRXs serving each cell, 
Rgure 3 is diagram showing the relatkmships 
between various protocols used in GSM networi^s. 
Rgure 4 is a schematic diagram of a monitoring 
system according to embodiments of the present 
invention showing its connections to a mobile net- 
work, 

Rgure 5 is a fkjwchart of the message matching 
procedure utifised in embodiments of the pres^ 
Invention, 

Rgure 6 is a schematic diagram showing the 
sequence of messages generated during the 
request fbr a channel by an MS, and the subse- 
quent allocation of a channel by a BSC in a GSM 
nrabile network. 

Rgure 7 is a flowchart of the steps taken and the 
messages utifised during the TRX discovery proce- 
dures of embodiments of the present invention. 
Rgure 8 is a schematic diagram showing tfie chan- 
nel afkx:ation strategies available to operators of 
GSM mobile networks. 

Rgure 9 is a schematic diagram showing mes- 
sages, sent to a pair of TRXs, whteh can be used to 
^regate the TRXs according to embodiments of 
the present invention v^en ciphering has been 
implemented by a network operator. 
Rgure 10 is a schematic diagam showing mes- 
sages, sent to a pair of TRXs, whk^ can be used to 
aggregate the TRXs according to embodiments of 
ttie present invention whether or not ciphering has 
been implemented by a network operator. 
Rgure 11 is a schematic diagram showing a 
^directed retry". In which a traffk: channel from a 
TRX whk:h is not within the MS's current cell is allo- 
cated to the MS. 

Rgure 12 is a ftowchart of the steps taken and the 
messages utilised during the TRX aggregation pro- 
cedures of entxxJiments of the present inventfon. 
Rgure 13 is a schematic diagram showing the 
sequence of messages sent as a consequence of 
an Initial message" sent by a MS. 
Rgure 14 is a schematic diagram showing flie 
sequence of messages which are generated during 
inter BSC handovers. 

Rgure ISisafkywchartof thestepslakenandthe 
messages utilised during tiie CI detemiination pro- 



3 



EP0848567A1 



6 



cedures of embcxiiments of the present invention. 
Figure 16 is a schematic diagram showing the mes- 
sages sent during the paging procedure used to 
notify a MS of an incoming call, and 
Figure 17 is a flowchart of the steps taken and the 5 
messages utTised during the LAI determination 
procedures of emtxxjiments of the present inven- 
tion. 

Embodiments of the present invention will be io 
. described with reference to a cellular mobile racfio net- 
work operating in accordance with the GSM technical 
specifications. The GSM techntoal spectficatlons as 
published by the European Telecommuntcations Stand- 
ards Institute (ETSI secretariat F-06921 Sophia Antipo- is 
lis CEDEX, France, e-mail: secretariat(9elsl.fr) are 
hereby incorporated herein by reference. 

With reference to Rgure 1, a GSM network com- 
prises a Networic and Switching Subsystem (NSS) 1, 
which connects wHh a plurality of Base Station Subsys- 20 
tems (BSS) 2. The BSS provide radio communication 
with mobile stations 3 (only one of which is shown in 
Rgure 1). The NSS 1 also communrcates with the fixed 
pubRc networic 4 (i.e. with the Public Switched Tele- 
phone Nelworii - PSTN, and the Integrated Services 2s 
Digital Networic - ISDN). The NSS 1 corrprises a 
number of Mobile Switching Centres (MSG) 5. Home 
Location Registers (HLR) 6. and Visitor Location Regis- 
ters (VLB) 6. MSCs peribrm the functkm of switches. In 
a similar manner to PSTN switches, but also deal with so 
the additional functionality required for mobile networics 
e.g. registration, authentication locatkMi updating, inter- 
national roaming, connection to the PSTN. HLRs con- 
tain infonnation on subscribers to the mobile networic 
e.g.k)catk)n, mobile Identity, while VLRs contain a sub- ss 
set of the HLR information which is required when a 
mobile statfon is In a particular geographical locatk}n. 

Each BSS 2 comprises a Base Station Controller 
(BSC) 8 and a plurality of Base Transceiver StatkMns 
(BTS) 9. Referring now to Rgure 2 each BTS 9 com- 40 
prises one or more elementary transceivers (TRX) 10 
and at least one Base Controller Function (BCF) 11. 
Each TRX 10 can emit and receive radk> signals and 
provides radio coverage over a focal area known as a 
cell. The number of TRXs per cell and the number of 4S 
cells per BTS is dependent on the traffic capacity that 
the network operator wishes to cater for. 

The racfio interface k>etween a rhobile station 3 and 
BTS 9 Is standardized within a GSM network. Similarly, 
the interlace between each BTS 9 and its associated so 
BSC 8. t>y which user data and signalling are 
exchanged, is also standardized, and Is known as the 
Abis interface. Each BSS 2 communicates with an MSC 
5 over a standarcfized interface known as the A inter- 
face. 55 

In GSM networks, user data and signalling are mul- 
tiplexed aaoss the radio interiSace, the Abis interface 
and the A interfaca Signalling within the NSS 1. over 



the A interfaces to the BSCs 8 and with the PSTN 4. is 
effected through signalling links which utilise signalling 
schemes based on the SS7 standard. Rgure 3 Olus- 
trates some of the protocols utilised in GSM. A number 
of the protocols have multqsle layers, and in many cases 
messages are transparent to some of the nodes 
through which they pass, for exanple some messages 
from tiie MS to the MSC will pass transparently through 
the BTS and BSC. Protocol layers which transparently 
pass messages through a node are shown as a dashed 
line in Rgure 3. 

Rado Resou rces Management . This protocol l^er is 
used for paging, radto channel access. C9)hering, 
handover, radfo signal control procedures, and radio 
signal measurements. RR messages pass between the 
MS and the BSC, and are transparent to the BTS. 
Rado Subsystem Manage ment (RSM) . RSM, although 
a term of this art is not an off idal GSM name, and Is 
often referred to by the GSM technical speclficatfon 
which descrfoes these messages Le. QSM08.58. RSM 
messages relate to the management of radio resources 
by the BTS. These messages appear only on the Abis 
interface and are carried by the LAPD protocol. 
Call Management rCM). The Call Management proto- 
cols oornprises Call Control (CC), Short Message Serv- 
ice (SMS) and Supplementary Services (SS). CM 
messages pass transparently from the MS through the 
BTS and BSC to the MSC. 

Mobifitv Management (MM). As ft>r CM massagafi^ MM 
messages pass between the MS and MSC, and are 
transparent to the BTS and BSC. 
BSS Management Anolication Part rsSSMAPV BSS- 
MAP messages pass between tiie BSC and MSC and 
are used to manage resources at the BSC. These mes- 
sages are passed across the A Interface via MTP (Mes- 
sage Transf^ Part) and SCCP (Signalling Connection 
Control Part) protocols which are both based on ttie 
SS7 sfandard. 

Layer 1 , the signalling fayer of ttie Abis interface, is 
dgital, usually at a data rate of 2048 Kblt/^ec with a 
frame stmcture of 32 x 64 Kbit/sec time slots [ITU-T 
G.703]. It is ttiese time slots that are monitored In 
accordance with emixxiiments of the present invention. 

Layer 2 of the Abis Interface is based on a standard 
ISDN protocol called LAPO (Link Access Procedure on 
ttie D-channel). This Is defined by CCITT reconvnenda- 
tion Q.920 and Q.921 and In Europe by ETS 300125 
produced by ETSI. LAPD provides for the klentif foation 
of the temitnal end points of a dafa link by ttie use of 
TEls in ttie address field of each frame. GSM has 
adopted ttie use of TEls for ttie addressing of TRXs k>y 
BTS*s. 

Layer 3 is the layer in which messages are carried, 
in the Abis interiace wittiin ttie RSM protocols, and on 
ttie A interiace within ttie BSSMAP and SCCP proto- 
cols. 

An overview of a discovery mettiod according to the 
present invention will now be given, prior to descrfoing 
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this method in greater detail. With reference to Rgure 4, 
monitoring equipment 12 is utilised to monitor links on 
both the Abis Interface and the A Interface of a QSM 
network. The monitoring equipment 12 comprises 
probes 13 attached to test points on both the Abis and 5 
A interfaces at a BSC site, an HP E4251A Cardcage 14 
available from Hewlett-Packard Umited. and an ana- 
lyser 15. comprising a Hewlett-Packard HP9000 series 
800 Unix sen/er, for analysing and conrelating the moni- 
tored data. A communications link 16 Is provided from w 
the analyser 15 so that the results of the autodlscovery 
of radio elements may be accessed from a remote loca- 
tion. Each probe 13 monitors a particular time slot on a 
communtoattons bearer on either the Abis or A inter- 
face, and is connected to a partkxilar interfece card is 
within the Cardcage 14. 

The monitoring system 14 is configured to attach a 
header to each data message nK)nitored by a probe 13. 
This header conrprises a time stamp which records the 
time at which the monitoring system received the mes- 20 
sage, event information and a physical identifier, which 
uniquely Identifies the monitored time slot The event 
Information indicates whether the message has been 
monitored from, for example, an Abis or an A interface 
and is recoidedfbr each timestot by the analyser 15 at 26 
the time the probes 13 and monitor system 14 are inl- 
tiafly connected to the network. This information may be 
supplied by the network operator and input to the ana- 
lyser, or may be deduced by the analyser from mes- 
sages monitored on each timesloL The physical 30 
klentifier attached to the message by the monitoring 
system may ccxnprise for example the cardcage 
number of the monitoring system, the interiace card 
number of the cardcage. the bearer number of the com- 
munications link being monitored and the time slot 55 
number being monitored. 

Althougfi the physk^l kJentifier attached to the message 
by the monitoring system altows tiie time stot on which 
a message has been nfK)nitored to be uniquely identi- 
fied, a furtiier level of physical klentif ication Is required 40 
in Older to be able to unkiuely identify the source or des- 
tination of the data message i.e. a TRX. This further 
level of physical identification is required because wittiin 
QSM systems it possible for more ttian one TRX to 
send data messages on tiie same time slot The final 45 
level of physical kfentification is provkled by the TEl 
which is sent wittiin tiie layer 2 LAPO. Each time a mes- 
sage Is monitored by tiie nrwnitoring system 14. the ana- 
lyser 15 extracts the TEl from layer 2 and combines it 
witfi infbnmation from the header attached by tiie moni- so 
toring system In order to construct a physical kJentif ier 
asfdtows:- 

Physical kientif Ier: cardcage number; interiace card 
nunriber; bearer number; time slot number; TEl 55 

A person skilled in this fieki will appreciate that 
attemative monitoring systems may utilise alternative 



physical kJentif iers. However, if the network being moni- 
tored utilises one timeskyt for more than one TRX, the 
TEl shoukJ be used as part of the physical klentifier. 

An aim of network discovery mettiods according to 
embodiments of tiie present invention is to map each 
physk»l identifier allocated by the monitoring system to 
a monitored TRX to a togteal klentifier which unquely 
identifies the TRX witiiin tiie logical structure of the 
monitored cellular mobile radio network. In GSM net- 
works a convenient logical identifier comprises a hierar- 
chical combination of tiie Location Area Identity (LAI), 
ttie Cell Wentity (CI) and ttie TEl for a TRX. The TEl is 
thus used botti as a part of the physical kfenfif ier klenti- 
fying a physical channel and as part of tiie logical kien- 
tif Ication of tiie radio elements witiiin the topobgy of ttie 
rnobile network. The hierarchical logteal klentifier tor 
each TRX is deduced by ttie analyser 15 by correlating 
data extracted from monitored messages. There are 
four b^ processes carried out t)y ttie analyser 15 as 
follows: 

Process 1 Discovery of TRXs 
Process 2 Aggregation of TRXs belonging to ttie 
same cell 

Process 3 Determination of cell klentifier 
Process 4 Detenminafion off tocation area identifier 

There is no required temporal order In carrying out 
ttiese processes* and ttie order in which ttiey are suc- 
cessfully achieved depends on ttie type of messages 
whwh happen to be monitored t)y ttie monitoring system 
12 and ttie order in which these messages are moni- 
tored. Several of ttiese processes may be carried out in 
a single step if ttie appropriate message is monitored. 

A key aspect of ttie dsoovery mettiod is ttie congela- 
tion, or matching, of pairs of signalling messages, to 
determine which messages contain common Informa- 
tion elements. When two messages contain common 
infbmiation elements it can be deduced ttiat ttiey relate, 
for example to ttie same TRX. cen. or LAI. However, 
because many of the signalling messages, particulariy 
on ttie Abis interiace. do not carry data which uniquely 
kf entities ttieir source or origin, a pair of messages con- 
taining common information elements may not neces- 
sarily be logically related. In order to overcome ttils 
difficulty entediments of ttie present discovery mettiod 
employ a time window when matching messages. 

This message matching technique will now be 
described witfi reference to Rgure 5. The first message 
of type A. of a pair of messages received by the moni- 
toring system 12 is time stamped and stored. When a 
second message of type B is received by ttie monitoring 
system 12 its time of arrival is compared witti ttie time 
stamp of message A. or if at ttie time of anival of ttie B 
type message, several A type messages are stored, ttie 
B type message anival time is compared witti ttie times- 
tamps of all A type messages. H ttie difference in time 
between ttie arrival of a B type message and ttie times- 
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tamp of a particular A type message is less than a pre- 
determined time window further processing of the two 
messages occurs. If the time difference between the B 
type message and a particular A type message is 
greater than this time window, this particular A type 5 
message is discarded. If the time difference between 
the B type message and all stored A type messages is 
greater than the pre<i6teniiined time window, the B 
type message is discarded. 

If a B type message is within the time window from 10 
the anrival of an A type message, the data contained 
within the B type message is compared to that within the 
A type message to determine if there are any common 
information elements. If such common information ele- 
ments are found, further actions are taken by the ana- is 
lyser 15 which are dependent on the nature of A and B 
messages, and which wUI be described In detail below. 
If common Information elements are not found message 
B Is discaided. but message A is retained for matching 
with further, later messages of type B an-iving within the 20 
time window. 

An additional, optional, further check on the vaGdity 
of message matching can be carried out Rather than 
accepting a message match as being successful when 
common informatkm is matched between a message B ss 
and one message A. further comparisons with stored 
messages of type A may be canried out If the common 
information element within message B is found within 
more than one message of type A, within the time win- 
dow, then these messages are discarded. If. after 30 
matching with all messages of type A, the common 
information element within the B message has been 
found within only one A message, the message match- 
ing is deemed to be successful. Thus, by discaiding non 
unique message matches, greater confkience can be 55 
placed In the message matching process. Whether this 
alternative, mae secure, message matching procedure 
is utifised depends on the relative Importance placed by 
the operator of the discovery method on speed of ctis- 
covery. level of processing available^ and the level of 40 
confidence required in the results of the discovery 
method. 

The length of the time window may be different for 
different message pairs, and should be chosen to be a 
small multiple of the typical time intewal between mes- 45 
sages of that type on the network being monitored. In 
order to choose appropriate time window lengths, mes- 
sages on the networi( should be monitored for some 
time, and the typteal intervals between particular mes- 
sages determined. Time window lengths can then be so 
optimised by trial and error. If time window lengths are 
too fong this wiU lead to messages being freely corre- 
lated, while If time windows are too short this will lead to 
an excessive number of messages being discarded and 
the network discovery method will take an excessively ss 
long time to discover the network. The messages moni- 
tored to carry out the four processes of the discovery 
method should in general be chosen to be ones which 
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cany as much network data as possible, kxjt also ones 
which appear on the networi^ as often as possible, so as 
to ensure rapid discovery of the networic 

Process 1 - Discoveiv of TRXs 

Each TRX is sensed by two physical channels, one 
afong whfoh messages are received, and one along 
which messages are sent from the TRX. These two 
channels define a logical link, and tfie present process 
determines the relationship between TRXs and links. 
This is achieved by monitoring pairs of messages, until 
one pair of messages are determined by the analyser 
15 to be passing to and from the same TRX. and there- 
fore to be on the same link. Once such a pair of mes- 
sages have been identified, the analyser 15 records that 
the particular TRX identified by Hs TEI) is served by a 
particular link comprising two channels kientifled by the 
physical identiHers attached to ttie messages by ttie 
monitoring system 14. Three procedures, each involv- 
ing the monitoring of different pairs of messages, can be 
used to carry out the present process. Two pairs of mes- 
sages are generated during the request tor a channel by 
an MS. and the sii)sequent allocation of a channel by a 
BSC. The messages passed, are shown schematically 
in Figure 6. The MS commences the sequence of mes- 
sages by sending a request message to tiie networic for 
a traTtt channel. This Initial message generates pairs of 
messages between the BTS and the BSC on the Abis 
interface, and it is ttiese pairs of messages that are 
sought by the present monitoring system. The third pair 
of messages that can be utilised in this process is gen- 
erated during the channel release procedure 

Apccss rgqwst procedure 

The first pair of messages ttiat can be utilised are 
sent during the access request procedure and belong to 
the RSM protocol. The first (type A) message Is the 
CHANnel ReQuireD message [QSM TS 08.58. 8.5.3] 
and the second (type B) message is the IMMediate 
Assignment CoMmanD message [QSM TS 08.58. 
8.5.6]. CHAN RQD is sent from the TRX to the BSC. 
while IMM ASS CMD is sent from the BSC to the TRX. 
The IMM ASS CMD message carries one of three pos- 
sible RR assignment commands: IMMEDIATE 
ASSIGNMENT (QSM TS 04.08, 9.1.18], IMMEDIATE 
ASSIGNMENT EXTENDED (GSM TS 04.08. 9.1.19]. 
and IMMEDIATE ASSIGNMENT REJECT [GSM TS 
04.08, 9.1.20]. The common Infbnmation element, 
searched for by the analyser 15. between the CHAN 
RQD message and any one of the three IMM ASS CMD 
messages is a request reference element [QSM TS 
08.58. 9.3.19]. This request refererKe comprises a /an- 
dom access part (QSM TS 04.08. 9.1.8] (a small ran- 
dom number of between 2 and 5 bits) which klentif ies 
the access request and an absotuie frame mrriber 
[QSM TS 04.08. 10.5.^38] (a modulo 42432 nmter 
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related to the absolute time of the frame). Although the the links for all TRXs can be discovered by monitoring 
absohjte frame number is a large number, there is still a these messages. A disadvantage in using the channel 
danger that two unrelated messages wilt be monitored activation procedure is that the channel number can 
containing the same absolute frame number, for exam- only assume 120 different values, thus the same value 
pie if two requests were made from different TRXs at the 5 is relatively frequently utilised within channel activation 
identical absolute time. Hence when matching mes- messages which relate to different TRXs. It is thus par- 
sages the analyser 1 5 employs the whole of the request ticularly important to con^ectly determine a time window 
reference element, including both the random access value to be used in the message matching procedure so 
part and the absolute frame number in order to avoid as to avoid incorrect association between TRXs and 
false matches. Once the monitoring system receives a w physical channels. 20 milliseconds has been found to 
CHAN ROD message and any one of the IMM ASS be a suitable time window for this message pair. 
CMD messages within a pre-determined time window of 

each other, and these messages owitain identical Channel release procedure 
request reference elements, then the analyser 15 will 

record that the two physical identifiers attached to these 15 Two messages are utifised in the channel release 

two messages belong to the same TRX and thus that procedure for TRX link discovery. These are RF CHAN- 

the two monitored physical channels betong to the nel REI^e [QSM TS 08.58, 8.4.14] sent from the 

same togical link. 45 milliseconds has been found to be BSC to the TRX and RF CHANnel RELease ACKhowl- 

a suitable time window lor this message pair. edge [GSM TS 08.58. 8.4.19] sent from the TRX to the 

A disadvantage in utilising the access request pro- 20 BSC. The common Information element sought within 

cedure to kJentify TRX links is that these access request tiiese two messages is the same as ttiat for the channel 

messages only appear on TRXs which have a CCCH activation procedure described above i.e. the channel 

(Common Control CHannel). CHAN ROD is sent to a number. 10 milliseconds has been found to be a suitable 

TRX on the Random Access Channel (RACH) and the time window for ttiis message pair. Use of the channel 

TRX will respond witfi a IMM ASS CMD message on the 2s release procedure has the same advantages and disad- 

downlink CCCH. The access request procedure can vantages as use of the channel activation procedure, 

thus only be used to discover links that belong to TRXs TTie messages utifised in process 1 . TRX discovery 

which empk)y common control channels, and cannot be procechires are shown \n Figure 7. 
used to discover finks that belong to TRXs whteh 

employ only trafffc channels. $0 Process 2 - Ao oreoatlon of TRXs belonQlno to the 

same cell 

Ctiannel activation orocedure 

Ihis process is often required because fbr many 

The second procedure utifises one type A message QSM-type networks it is not possible to successfully 

and one of two possible messages of type B. These S5 cany out processes 3 and 4. the detemilnation of 

messages, all belonging to the RSM protocol, are respectively the Cell Identifier (CI) and Location Area 

respectively the CHANnel ACTlVation message [GSM Identifier (LAI), for all TRXs within one cell. However, if 

TS 08.58. 8.4.1], the CHANnel ACTlvation ACKnowt- TRXs belonging to ttie same cell have been aggregated 

edge message [GSM TS 08.58. a4.2], and the CHAN- (either before or after determination of CI and LAI) then 

nel ACTlVation Negative ACKnowledge message [GSM 40 tfieClorLAIdetemru'nedforanyTRXwitiiinthatcellcan 

TS 08.58. 8.4.3]. CHAN ACTIV is sent from the BSC to be assigned to the other TRXs known to belong to the 

the TRX, the other two are sent in the opposite db'ec- same cell. 

tion. The CHAN ACTIV NACK message is sent only if Whettier or not process 2 is required In the discov- 

the TRX fails to allocate tiie required channel dhemise ery procedure is dependent on the choice of channel 

the CHAN ACTTl V ACK message is sent The common 45 altocation strategy that has been made by the network 

infonnation element that is sought between the CHAN operator. The network operator may choose to use the 

ACTIV message and one of the CHAN ACTTIV ACK or same channel aUocation strategy tiiroughout his net- 

the CHAN ACTIV NACK messages is the channel work, or may choose to use different channel allocation 

number [GSM TS 08.58, 9.3.1]. This number is an octet strategies in different parts of the network. At any given 

which Identifies tiie channel to be allocated i.e. the so moment tiie available Traffic Channels (TCHs) within a 

channel type, time slot, and potentially sub time slot BSC are either allocated to the exdusrve use of an MS. 

Again, once the monitoring system has klentif ied klenti- or form part of a pool of kille channels from which a 

cal channel numbers witiiin two of these messages channel is drawn when required. There are a number of 

received within a pre<J^ined time window of each different circumstances In which a channel needs to be 

otiier. the physical identifiers attached to ttie messages ss allocated, fbr eiample call set up, location updating, 

can be associated with a particular TRX. handover, and these different situations require different 

The use of this procedure has the advantage that radfo channel resources. However, the MS initially gives 

all TRXs send and receive these messages, and ttius only a rough description of its requirements for a traffic 
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Channel, thus a strategy for channel allocation is 
required. GSM network operators have a choice of three 
channel allocation strategies. 

These strategies are described with reference to 
Figure 8. Very Early Assignment (VEA) cons^ in allo- 
cating a traffic channel at the Initial assignment This 
strategy can be very inefficient in its use of radio 
resources since a full traffic channel may be allocated 
when not required. Early Assignment (EA) comprises 
allocating a Standalone Dedicated Control Channel 
(SDCCH) and then subsequently allocating a TCH as 
soon as it is known for sure that this type of channel will 
be required. Off Air Call Set Up (OACSU) comprises 
allocating an SDCCH initially, then waiting until the 
called party has answered before attempting the subse- 
quent assignment of a TCH. This strategy may result in 
a signif icant delay in connecting the parties, once the 
caDed party has answered, dependent on the availabil- 
ity of TCHs at this instant 

If VEA is employed in the part of the network being 
monitored, then process 2 of ttie discovery metiiod is 
not necessary since sufficient signalling messages will 
be passed to and from each TRX for processes 3 and 4 
to determine the CI and LAI fbr each TRX. However, 
even where VEA is employed process 2 may still be uti- 
lised in the discovery mettiod. aHhough not absolutely 
necessary in order to speed up the discovery method. 

If EA or OACSU are utilised it is common practice 
amongst network operators to configure TRXs within a 
cell 80 that SDCCHs are very often (or indeed always) 
assigned to the same, single TRX within a ceil. Further- 
more^ in genera] this same TRX is chosen as ttie TRX to 
carry the CCCH for the cell. In this case processes 3 
and 4 can determine the CI and LAI only for this one 
TRX wHNn the cell, and process 2 is required to allow 
the CI and LAI to be assigned to the other TRXs within 
the same cell. 

When a BSC allocates a new TCH. it will communi- 
cate with a first TRX handling SDCCH and then it wilt 
communicate wHh a seoond TRX on which ttie new 
TCH is to be established. In some circumstances tiiese 
two TRXs may be the sama Some of the messages 
sent to tfie two TRXs by the BSC during the setting up 
of the new TCH contain common information elements 
and. if these can be klentified. the two TRXs can be 
determined to be witfiin ttie same cell. Two sets of mes- 
sages have been Identified which can be used to aggre- 
gate TRXs belonging to ttie same cell. One set can be 
utilised only when ciphering has been implemented by 
the network operator, and ttie otiier set can be utilised 
whettier or not cfphenng has been implemented. 

Procedure requiring dpherlna to be Implemented 

When dphering is implemented, all data sent over 
ttie radio patfi is encrypted by an algorittim termed A5 
[GSM TS03.20] which utilises a key termed Kc. This key 
is 64 bits long and is calculated independentty botti 



ttie MS and the network each time a radio connection is 
set up. The key Kc is never transmitted over ttie radio 
patti but is cateulated at the MS. and wittiin ttie network 
using a further algorittim termed A8 [GSM TS03.20]. 

5 Two Inputs are required by the algorittim A8 In order 
to generate ttie key Kc. The first, a f urttier k^ termed Ki 
is stored by both ttie SIM. within ttie MS. and by ttie 
Auttientication Centre (AuC) within ttie network. The 
second input required by A8 is a random number RAND 

10 CTeated randomly by the network and sent to ttie MS 
each time a radio connection is set upi Once ttie key Kc 
has been catoulated, ttiis is sent to the TRX so ttiat it 
can decipher coded radio messages received from ttie 
MS. In order to kJentrfy, and to aggregate, ttie SDCCH 

75 TRX and the TRX on wNch ttie new TCH is to be allo- 
cated, ttie ENCRyption CoMmanD [GSM TS 08.58 
8.4.6] and CHANnel ACTIVation [GSM TS 08.58 8.4.1] 
messages are monitored. 

Botti messages belong to ttie RSM protocol and 

20 ttiey are sent from ttie BSC to a TRX (see Rgure 9). The 
ENCR CMD message is sent, on ttie Abis interface, to 
ttie TRX handling ttie SDCCH after ttie access request 
and befbre ttie fuD call information and carries tiie 
dphering key Kc cateulated by ttie network. The same 

25 key is carried by the CHAN ACTI V message that is sent 
to the TRX which is assi^ed the required TCH once ttie 
BSC knows which type of call is required by ttie MS. The 
common element sought in ttiese two messages is ttie 
ciphering key Kc, which Is earned wittiln ttie Encryption 

30 biformation [GSM TS 08.58, 9.3.7] element of ttie mes- 
sages. Because ttiis ciphering kgy is several octets 
long, it is very unlikely that ttie same k^ will be used by 
more ttian one radio connection during ttie same time 
window. Hence^ once a pair of ENCR CMD and CHAN 

ss ACTIV messages have been monitored which contain 
ttie same qphering key Kc, and which have been sent to 
two different TRXs, these two TRXs are recorded by ttie 
analyser as belonging to ttie same cell. 

The time window utilised for ttie matching of ttiese 

40 messages needs to be relatively tong since a number of 
procedures are canied out in ttie time between ttiese 
two messages (eg call set up) so ttiat ttie typical interval 
between them is long. Two seconds has been found to 
an effective time window. 

45 

Procedure not gequlHna dpheriny to be Impie- 

omsA 

The following technique can be utilised to aggre- 
60 gate TRXs regardless of whether c^ering has been 
implemented by ttie network operator. The pair of mes- 
sages employed are ttie CHAN ACTIV [GSM 08.58. 
8.4.1] message and the ASSIGNMEfMT COMMAND 
[GSM 04.08, 9.1 .2] message. These messages are sent 
55 from ttie BSC to a TRX on ttie Ab^ interface. The 
assignment command message is part of ttie RR proto- 
col and is carried wittiin a DATA REQuest message 
[GSM 08.58, 8.3.1] which itself is part of ttie RSM proto- 
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col. The assignment command message is transparent Directed Retry 
to the receiving TRX, which simply tbnwards it on to the 

relevant MS. Both of the procedures described abo\fe for cany- 
The CHAN ACTIV message, as discussed above, is ing out process 2 to aggregate TRXs assume that the 
sent to the new TRX on which the new TCH is to be alio- 6 TRX on which the new TCH Is assigned is witrtn the 
cated. Once the new TCH has been allocated, the BSC same cell as the SDCCH TRX. This is not always the 
sends a DATA REQ message, containing an assign- casa Phase 2 of the GSM standard provides for the 
ment command, on the Abis Interface to the old TRX assignment of a TCH to an MS firom a TRX In a cell 
(the one handling the SDCCH), in order to give the MS other than the current cell of the MS. This feature is 
sufficient information to switch to the new TCH. this is io ternied Directed Retry [GSM TS 03.09. 1 1]. The result 
shown schematically in Figure 10. The CHAN ACTIV of such a directed retry is shown schematically in Figure 
message and the assignment conwand message both 11. Clearly, if the new TCH for the mobile is assigned to 
contain the channel number (GSM TS 08.58. 9.3.1]. a TRX In a different cell, it would be fricorrect to aggre- 
This is the same common infomration element as uli- gate the SDCCH TRX and the new TRX as belonging to 
lised in two of the process 1 procedures for discovering is the same cell. This problem can be avoided by the net- 
TRXs described abova The matching of this informa- work discovery method by nrwnitoring a further informa- 
tion element between these messages occurs In tion element, the activation type [GSM TS 08.58. 9.3.3] 
accordance with the message matching technique within the CHAN ACTIV message which indicates when 
desaibed above, with reference to Figure 5. Once the a directed retry is occumng. 
same channel number element has been Identified 20 A directed retry is initiated when the serving ceil 
within two of these messages, within the requisite time chosen by the MS in idle mode is different from the serv- 
window. the two TRXs are recorded by the analyser 15 ing cell chosen by the network. In tWs case, in phase 2 
as belonging to the same cell. Since, as stated above, implementations of GSM. rather than perfonrtng an 
the channel number element can assume only 120 dif- assignment to the MS chosen ceU and then a subse- 
ferent values, the time window value for this matching 25 quent handover to the network chosen c^l. a handover 
procedure must be carefully chosen. 30 milliseconds is performed immediately, prior to assignment In this 
has been found to be a suitable time window for this case, the activation type element of ttie CHAN ACTIV 
message pair. message will indicate that activation is related to fafiter- 
In order to inprove the accuracy of TRX aggrega- cell channel changa Thus both procedures for carrying 
tion, a furtiier common ^formation element which may so out process 2 TRX aggregation monitor for ttiis indlca- 
be present in ttiese messages, can be utilised. If ttie tion witiiin ttie activation type element, and if found dis- 
network operator requires compatibility witti GSM card tiie related messages as befonging to a directed 
phase 1 equipment, a channel identification element retry. Alttiough such messages cannot be used to deter- 
[GSM TS 08.58, 9.3.^ wlH be present not only In the mine that ttie two TRXs Involved betong to the same 
ASSIGNMENT COMMAND message but also in the ss cell, they do indicate that tiie two TRXs defirtitely do not 
CHAN ACTIV message and tiius may used for matching belong to the same cell. This information may be use- 
purposes. The channel identif kation element provkles fully employed by ttie analyser 1 5 in oonfimiing ttie cor- 
ttte MS witti infamation regarding ttie absolute fre- red aggregation of TRXs. 

quency or frequency hopping parameters required for Rgure 12 is a ftowchartwhtoh schematically shows 

the TCH which the MS win switch ta The channel kien- 4o ttie procedure carried out by ttie monitoring equipment 

tification element has two parts, the channel description during Process 2, aggregation of TR)te. 
[GSM TS 04.08. 10.5.2.5] and tiie mobile allocation part 

[GSM TS 04.08. 10,5.2.21]. The channel description Process 3 ■ Det ennlnatioii of Cell Identity 
part and mobile allocation part of ttie channel identif tea- 

tion element in CHAN ACTIV messages are always 45 The Cell Identity (CI) is a value of fixed lengtti witti 

togettter. however ttiese two parts are in separate sec- two octete, whteh identifies ttie cell wittiln its focation 

tions of ASSIGNMENT COMMAND messages. Thus area [GSM TS 08.08, 3.2.2.27]. The CI does not 

when matching channel Wentif fcation elements each uniquely identify ttie cell wittiln ttie network, unless it is 

part of ttie element must be matched separately When concatenated witti ttie LAI to fomn ttie CGI (Cell Gfobal 

ttie channel klentifteation element is utilised for match- so Uentification). In some cases ttie GCI can be deter- 

ing messages, a match is not deemed to be successful mined at ttie same time as ttie CI, so ttiat process 4 

unless botti parts of ttie channel Mentification element (Determinatfon of Location Area kJentifier) is not 

match. When employing botti the channel kJentiffk»tion required. 

element and ttie channel number element to aggregate Two procedures can be used to correlate CIs witti 

TRXs, aggregation is only canried out when both ele- ss TRXs, one based on monitoring messages containing 

ments are successfully matched wittiln ttiar respective Initial messages' sent liy an MS during ttie channel 

messages. assignment process, and ttie ottier based on monitoring 

handover requests. Botti ttiese procedures require mes- 
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sages on the A interface to be monitored in addition to 
messages on the Abis interlace since the CI does not 
appear in signalfing messages on the Abis interfece. 

Initial Message" Procedure s 

When a request from an MS for a channel assign- 
ment has been accepted by a BTS. the BTS sends the 
MS information regarding the allocated channel on the 
downlink CCCH. When the MS has received this Infor- 10 
mation. the first action it takes on the new channel Is to 
establish a link layer connection for signalling messages 
on the new channel. This is achieved by sending a 
SABM (Set Asynchronous Balanced Mode) frame. The 
SABM frame itself canies a layer 3 signalling message, is 
tentied the "initial message" [GSM TS 04.08), whtoh is 
"piggybacked" onto the SABM frama 

Five different initial messages are allowed by the 
GSM specifications, which messages each can7 data 
related to the reason the initial access was triggered. 20 
The five possft)le reasons for triggering an initial mes- 
sage are 1) a response to a paging request, 2) nonml 
or periodical tocab'on updating or an IMSI attach, 3) an 
IMSI detach, 4) CM re-establishment request and 5) 
service request (e.g. call set up, SMS, Supplementary 2s 
Service Management). In each case the initial message 
sent by the MS is incorporated into two further mes- 
sages, the first on the Abis interface and the second on 
the A inteiface. The present procedure utilises the initial 
message element within these messages as the com- 30 
mon inforniation element to achieve matching between 
the messages, in greater detail and with reference to 
Figure 13, the SABM frame (with piggybacked initial 
message) sent by the MS to the TRX on the radio inter- 
face causes the BTS to send an RSM ESTablish INDi- ss 
cation message [QSM TS 08.58. 8.3.6] which 
incorporates the Initial message to the BSC on the Abis 
interface. This EST IND message is the first monitored 
message kxsked for by the present procedura Receipt 
of the EST IND message at the BSC causes the BSC to 40 
compile a COMPLETE IJVYER 3 INFORMATION mes- 
sage [QSM TS 08.08. 3.2.1.32] which incorporates the 
initial message and furttier infomiation Including the CI 
or in some cases the (3CI for the cell sensed by the TRX 
which generated the EST IND message. This COM- 4S 
PL£TE UYER 3 INFORMATION message is passed 
from the BSC to the MSC, and is the second monitored 
message. By monitoring these two messages, and 
matching the initial message elements found within 
each, within a time window as described above, tiie CI so 
for a particular TRX on a particular channel (labelled by 
the physical Identifier given by the monitoring system) 
can be identified. 30 milliseconds has been found to be 
a suitable time window for this message pair. Depend- 
ing on the number of other steps within ttie network dis- ss 
oovery method that have been successfully earned out 
the CI can be alkx»ted to a TRX identified by its TEI 
(Process 1); and can also be aHocated to otfier TRXs 



aggregated as belonging to tiie same cell (Process 2). 

Preferably, the whole of the initial message is uti- 
lised as the common information element looked for 
when matching messages according to tills procedure. 
However, all five of the initial messages types contain a 
mobile identity element [GSM TS 04.08. 10.5.1.4] (eg. 
IMSI or TMSI) and ttiis mobile identity element alone 
can fomi tiie common information element. 

Handover Procedure 

This procedure identifies CIs and allocates them to 
particular TRXs by monitoring messages which are 
generated during inter BSC handovers, i.e. handovers 
of tiie MS between different BSCs via an MSC. With ref- 
erence to Figure 14 when an inter BSC handover is ini- 
tiated the MSC 21 serving tiie two BSCs 17 and 19 
sends a HANDOVER REQUEST message [GSM TS 
08.08, 3.2.1.8] to the BSC 17 serving ttie BTS 18 in 
which the target cell for the handover is focated. This 
HANDOVER REQUEST message is sent within the 
BSSMAP protocol on the A interface, and contains the 
CI for the cell presentiy serving the MS, and the CI for 
tiie target cell to which the MS is to be handed over. By 
monitoring two different messages (one for the serving 
cell and one for the target cell, as descrit>ed befow) on 
ttie Abis interface, and matcNng each of these with the 
HANDOVER REQUEST message on the A Interfoce, 
botti the serving oeO Ci and the target cell CI can be 
detenrrined and alfocated to TRXs. 

Unfortunately, the HANDOVER REQUEST mes- 
sage does not contain a common information element 
ttiat can be matched with ttie relevant messages on ttie 
Abis interface, so a preTiminary matching between ttie 
HANDOVER REQUEST message and a furttier mes- 
sage on the A interface must be carried out This mes- 
sage Is ttie HANDOVER REQUEST ACKnowledge 
message [GSM TS 08.08, 3.2.1.10] which is sent from 
ttie BSC 17 to ttie MSC 21 witfiin ttie BSSMAP protocol 
in response to ttie HANDOVER REQUEST message. 
Within ttie SCCP l^er of a message sent on ttie A inter- 
face tiiere is an SCCP header which comprises routing 
infomiation including source and destination addresses 
in terms of point codes. In any particular message 
between a BSC and MSC these point codes comprise 
source and destination focal references dependent on 
ttie direction in which ttie message has been sent. 
These focal references remain the same for the duration 
of ttie SCCP connection and, since a HANDOVER 
REQUEST message and ttie corresponding HANDO- 
VER REGHJEST ACKnowledge message are sent on 
the same SCCP connection, can be used to match 
tiiese messages. Thus tiie SCCP header information is 
monitored by probes 13 on the A int^ce and the ana- 
lyser 15 is arranged to match HANDOVER REQUEST 
messages and HANDOVER REQUEST ACKnowledge 
messages having ttie same source and destination 
focal references. Furttier details of ttie tracing of SS7 
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sec? addressing irrlbrmation on the A interface can be 
found in the present Applicants co-pending European 
application EP 96303147.1. which is Incorporated 
herein by refererK:e 

Although the HANCX)VER REQUEST ACK mes- 
sage contains common information elements that can 
be matched with messages on the Abis interface as 
described bebw. it does not contain the CI for the send- 
ing or target cells. Thus once matching with Abis mes- 
sages has been sucessfully perfbmied. the Cl's are 
acquired from the associated HANDOVER REQUEST 
message. 

Sflrvtnq Cftii CI 

The serving cell CI can be determined by matching 
common information elements between the HANDO- 
VER REQUEST ACK message and an RR-HANDO- 
VER CMD message sent from the serving BSC 19 to 
the sendng BTS 20. TMs HANDOVER COMMAND 
[GSM TS 04.08. 9.1.15] is sent on the Abis interface 
within a DATA REQUEST message of the RSM proto- 
col. The HANDOVER CMD is also contained within the 
HANDOVER REQUEST ACK. thus allowing matching 
between the DATA REQUEST message and the 
HANDOVER REQUEST ACK message. Since the 
whole of the HANDOVER COMMAND is included within 
both messages, this fomis the common infomiation ele- 
ment and matching is performed between all elements 
of the HANDOVER COMMAND. If the HANDOVER 
COMMAND is correctly matched witNn a time window 
(2 seconds has been found to be effective) as described 
above, then the serving ceU CI carried within the 
HANDOVER REQUEST message (matched to the 
HANDOVER REQUEST ACKhowledge message) can 
be allocated to the serving TRX within the BTS 20. 

TfwggtCgWCI 

When the MS is detected at the target BTS 18. a 
HANDOVER DETECTION {QSM TS 08.58 8.4.7] mes- 
sage is sent over the Abis interface on the RSM protocol 
from the target BTS 18 to the BSC 17. Both the 
HANDOVER DETECTION message and the HANDO- 
VER REQUEST ACK message contain a channel 
number (giving the channel type and time slot allocated 
to the MS within the target cell), and this common infor- 
mation element is ut'lised to match these messages 
within a time window (3 seconds has t>een found to be 
effective). Matching of the messages allows the target 
cen CI (within the HANDOVER REQUEST message 
matched to the HANDOVER REQUEST ACK message) 
to be allocated to the serving TRX within the BTS 18. 

Rgure 15 is a flowchart which schematically shows 
the procedure canied out during Process 3. detenmina- 
tionof CI. 

Again, the CIs for the target and serving cells can 
be allocated to other TRXs known to be within the same 



cell via a Process 2. TRX aggregatfon step. 

Process 4 - Dgtermlnati on of Location Area Identftv 

5 As stated above during the description of Process 3 
(Determination of Cell Identity), the COMPLETE LAYER 
3 INFORMATION message m^ contain a GCI rather 
than simply a CL If this is the case, the LAI may be 
detemiined from the GCI without any further informa- 

10 tion. Alternatively, if only the CI is found within the COM- 
PLETE LAYER 3 INFORMATION message, or if 
Process 3 has not yet been carried out. one of the fol- 
lowing three procedures may be utilised to determine 
the LAI. The first procedure is based on monitoring pag- 

15 ing messages, and requires matching of messages 
between the A and the Abis interfaces. The second and 
third procedures are both based on monitoring location 
updating messages, and do not require matching of 
infomiation between messages, but simply the selection 

20 of the correct message, and the extraction of the LAI. 

Paging prpcetfw 

The locatton area Is a concept utilised by GSM type 

25 networi® which seeks to strike a balance between the 
number of cells which must be paged to locate a partic- 
ular MS. and the amount of signalling traffic generated 
by MSs updating the f ixed part of the networic wHh their 
cunrent location. The location area is a togical grouping 

50 of a plurality of cells having a convnon location area 
kientification. An MS only initiates a location updating 
process when it determines that it has changed tocation 
areas, thus reducing the amount of kx»tion updating 
network traffic. When the networi^ needs to route an 

3B Incombig can to a particular MS it win only need to trans- 
mit a paging message to ttie cells witiiln the relevant 
location area, rather than to all cells wrtfv'n tiie networic 
With reference to Rgure 16. when the fixed networic 
needs to notify an MS of an incoming call, the MSC 5 

40 sends a PAGING message [GSM TS 08.08, 3.2.1.19] 
within the BSSMAP protocol on the A interface to the 
BSCs 8 covering the focation area in which the MS is 
known to be. The paging message is specific to one MS. 
and contains infonnatfon regarding the cells in which 

45 the PAGING message must be broadcast and may con- 
tain the LAI. The cells within a location area are gener- 
ally served by one BSC 8 but In some cases may be 
served by more than one BSC as shown in Rgure 16. 
The only restriction imposed by tiie GSM specifications 

60 regarding which cells belonging to a k)cation area, is 
ttiat all cells must be under the control of a single MSC 
5. Each BSC 8 receiving tiie PAGING message then 
sends a PAGing CoMmanD message [GSM TS 08.58, 
8.5.5] within the RSM protocol on tiie Abis interface to 

55 each TRX having a PCH (Paging ChanneO within tiie 
relevant tocation area. Only one TRX witiiin a cell will be 
utilised to broadcast tiie PCH. 

The PAGING message and the PAGing CoMmanD 
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message both contain a common tnlbrnmtion element 
namely the mobile identity element of the MS being 
paged. This mobile identity element will be the fMSI. or 
if a TMSl has been established between the MS and the 
network, the TMSl is utilised for security reasons. Thus 
the monitoring system 14 monitors for PAGING mes- 
sages on the A interface, and PAGing ComManD mes- 
sages on the Abis interface, and QH the PAGING 
message oontains an LAI) attempts to match the mobile 
Identity elements found within these messages within a 
time window as described above. The time window 
used within this paging procedure may safely be very 
long because an IMSI is unique globally and a TMSl is 
unique within a particular location area. Thus it is 
unlikely, if two kientk^l T^l'S are found, that they will 
relate to different MSs. Furthermore, because paging 
messages are often repeated if there Is no response 
from the MS ft is advantageous to utilise a long time win- 
dow. It has been found tiiat time windows of up to one 
minute are effective. 

When a match has been found the analyser 15 is 
able to correlate the LAI found within tiie PAGING mes- 
sage witti the TRX to wftich ttie matching PAGing Com- 
ManD message has been sent As stated above, 
PAGing ComManD messages will only be sent to TRXs 
which broadcast PCHs. However, once Process 2 
(Aggregation of TRXs belonging to the same celQ has 
been carried out the LAI alfocated to a TFOC transmitting 
a PCH can be allocated to all other TRXs within the 
same ceO. Furttiemfiae, by matching the PAGING mes- 
sage on the A interface with each of tiie PAGing Com- 
ManD messages on the Abis interface the LAI for all 
cells wittiin ttie tocation area may be determined. 

Location Updating Precedwres 

A number of messages sent during location updat- 
ing can be utilised to detemrvne the LAI for a TRX witii- 
out ttie need to perform message matching. Two of 
ttiese messages are of ttie "initial message' type sent 
from ttie MS to the fixed network, and ttie ttiird one is a 
message sent from the fixed networi^ to ttie MS in 
response to a focation updating request. 

The IMSI attach [GSM TS 04.08. 4.4.3] is a spedffo 
type of initial message which Is sent when, an MS re- 
registers wittini a tocation area in whfoh it had previously 
been registered. This IMSI attach message is incorpo- 
rated within an RSM establish indication message and 
is sent by the sennng TRX over ttie Abis interface to the 
serving BSC. For ttie present purposes ttie Important 
aspect of ttie IMSI attach message is ttiat it contains ttie 
LAI in which ttie MS is located. Thus ttie LAI can be cor- 
related wrtfi ttie TRX ttiat sent ttie establish indication 
message wittiout needing to perfonn any message 
matching. Unfortunately for ttie present purposes, ttie 
IMSI attach, and Its corresponding detach procedure is 
not mandatory wittiin GSM type networic, ttius the net- 
wtk operator may choose not to Implement ttiis proce- 



dura 

A second form of initial message which may be 
monitored to detemiine LAI wittiout message matching 
is ttiat of call re-establishment. The call re-establish- 

s ment procedure [GSM TS 04.08. 4.5.1 .6] can be consid- 
ered as an emergency, MS triggered, handover 
procedure which is implemented when a call connection 
is suddenly lost. In ttiese circumstances ttie MS sends 
a RE-ESTABLISHMENT REQUEST which is incorpo- 

10 rated by ttie TRX into an RSM establish indication mes- 
sage, and passed to the BSC on tiie Abis interface In 
cases where ttie TMSl is used as the mobile identity, ttie 
LAI is also incorporated into ttiis message in order to 
unambiguously identify ttie MS. This call re-establish- 

15 ment facility Is also not mandatory so network operators 
may chose not to implement it. 

Attiird location updating message ttiat can be mon- 
itored to determine an LAI without message matching is 
ttie LOCAnON UPDATING ACCEPT message [GSM 

20 TS 04.08, 9.Z13]. The LOCATING UPDATING 
ACCEPT message is sent by ttie sennng MSC in 
response to a LCX^ATION UPDATING REQUEST mes- 
sage [GSM TS 04.08. 9.2.15| sent by ttie MS. The 
LOCATION UPDATING ACCEPT message is transpar- 

25 ent to tiie BTS which simply passes it on to tiie relevant 
TRX wittiin a DATA REQUEST message. By monitoring 
for ttiis message on ttie Abis interface, which contains 
ttie LAI of ttie MS'^ current location, ttiis LAI can be aOo- 
cated to ttie TRX to which the message has been sent 

30 Rgure 1 7 is a flowchart which schematically shows 
ttie procedure carried out during Process 4, determina- 
tion of location area identifier. 



System infomatlon 



Occasionally a configuration parameter, for exam- 
ple the LAI of a cell, may be changed by ttie network 
operator, and a system infonnation message will be 
sent out giving details of such a changa The frequency 

40 dl ttiese messages will depend on ttie maturity of ttie 
operator's networi^ but typically configuration parame- 
ters are likely to be changed only over long time scales 
such as a week or a montti and are thus not particulariy 
useful for ttie present discovery mettiod. However, ttie 

4s following ttiree messages couki possibly be sent on ttie 
Able interface 1) SACCH INFO MODlf^ [GSM TS 
08.58. 8.4.20] 2) BCCH INFOrmation [GSM TS 08.58. 
8.5.1] and 3) SACCH FILLING [GSM TS 08.58. 8.6.2]. 
Monitoring of any of these three messages will enable 

60 ttie CI and LAI for a particular TRX to be detennined 
from the message content wittiout requiring matching to 
any ottier messages. 

Claims 

55 

1. A network discovery mettiod for determining infor- 
mation atxxit a cellular mobile radio network com- 
prising a fixed part having switching elemente and 
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radio elements providing radio coverage in a plural- 
ity of cells, each cell having at least one said radio 
element, and mobile stations for oonvnunicating 
with said fixed part via the radio elements, the 
method comprising:- 5 

monitoring signalling messages passed 
between the radio elements and the switching 
elements, 

selecting at least one signalling message in 10 
accordance to predetermined selection aiteria. 
extracting data from said at least one message, 
correlating said extracted data with previously 
extracted data and. 

repeating said selecting, extracting and corre* is 
lating steps until each monitored radio element 
is identified with respect to other network enti- 
ties. 

A network discovery method as claimed in daim 1, 20 
wherein said selecting step comprises selecting a 
pair of related messages. 

A network discovery method as claimed in claim 1 
or 2, wherein the cetts are k)gically grouped into 2s 
location areas and each radio elen^ is uniquely 
identified by the cell within which it reskles, and the 
tocation area within which the cell resides. 



ceding claim, wherein signalling messages passed 
between two switching elements are also moni- 
tored. 

9. A network discovery method as claimed in any pre- 
ceding daim, wherein the cellular mobile radio net- 
work is of the GSM type and messages are 
nranitored across the Abis interface between radio 
elements and switching elements. 

10. Apparatus for identifying the relationsh'f) between 
radio elements and other network entities within a 
cellular mobile radio network, the network compris- 
ing a fixed part having switching elements and radio 
elements provk:ling radio coverage in a plurality of 
ceils, each cell having at least one said radio ele- 
ment, and mobile stations for communicating with 
sM f i3ffld part via the radio elements, the apparatus 
comprising:- 

probe means for nrx)nitaing signalling mes- 
sages passed between an identified one of the 
radio elements and the switching elements, 
extracting means for extracting data from pre- 
determined signalling messages, 
analysis means for detern^nlng from extracted 
data a relationship between the monitored 
radio element and other network entities. 



A network discovery method as dainned in claim 2 
or 3. wherein the predetemvned selection criteria 
for selecting a pair of messages are:- 

i) each message is of a different message type, 
and 

n) tiie messages contain at least one infbrma- 
tion element in common. 

A networt< discovery method as claimed In daim 4. 
oonprising a further matching step in wftich the 
common information element In each of tiie mes- 
sages is compared and data from the pair of mes^ 
sages is only utilised in saki con-elatir^ step if the 
common information element in each message is 
Identical. 

A networic discovery mettiod as claimed in daim 5. 
wherein at least three messages are selected and 
wherein one message is matched to a plurality of 
messages of the same message type. 

A network discovery method as claimed In any one 
of daims 2 to 6. wherein data from a pair of mes- 
sages is only utilised in sakj con-elating step if the 
messages are monitored wiUiin a predetermined 
time period of each ottier. 

A networic discovery mettiod as daimed In any pre- 



30 11. Apparatus as claimed In daim 10. wherein the 
extracting means extracts data from related pairs of 
signalling messages, and ttie analysis means com- 
pares at least a part of tiie extracted data and, if a 
match is found between such compared data, 

35 records a relationship between the monitored radio 
element and anottier networic entity. 

12. Apparatus as daimed in daim 11, wherein tiie 
probe means attaches to each monitored message 
40 an indication of tiie time at which tiie message was 
monitored and tiie analysis means only utilise data 
from pairs of messages which are monitored witiiin 
a predetennined time period of each ottier. 

45 13b Apparatus as claimed In claim 12, wherein tiie pre- 
determined time period is substantially ec|ual to tiie 
expected Interval between tiie particular pair of 
messages monitored. 

so 14. Apparatus as claimed in any one of claims 10 to 13, 
wherein tiie probe means attaches to each nfioni- 
tored message a physical Mentif ier whfeh kf entif ies 
tiie physk^ channel on whk:h the message has 
been monitored. 

55 

1 5. Apparatus as daimed in daim 1 4, wherein the anal- 
ysis means butkte a togical kJentifler, Uentifying a 
particular radio element, from data from monitored 
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messages and relates this logical identifier to the 
physical Identifier provided by the probe means. 

16. ApparatusasdaimedinanyoneofdalmslOtolS, 
wherein the relationship between monitored radio s 
elements, cells and location areas comprising logi- 
cally grouped cells, is detemiined. 

17. Apparatus as claimed in any one of claims 10 to 16. 
wherein the analysis means determines tor each io 
monitored radio element the two physical channels 

on which messages are passed to and from the 
radio element. 

18. Apparatus as claimed in any one of claims 10 to 16, is 
wherein the analysis means determines which 
radio elements are within the same cell and allo- 
cates cell related infbnnatlon detemiined for any 
one radio element within the ceil to the other radio 
elements within the same cell. 20 
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